A retailer announces a compliance audit of our range

A retailer's audit has no legal basis of its own; it is a term of the supply relationship. Its content, however, follows the General Product Safety Regulation (EU) 2023/988. Every economic operator must have internal processes for product safety in place that allow it to comply with the Regulation (Article 14). Manufacturers draw up technical documentation, keep it up to date and keep it for 10 years after the product is placed on the market (Article 9(2) and (3)), and importers keep a copy for the same period (Article 11(6)).^[1]

Retailers check because their own duties depend on it. A distributor verifies before selling that the identifier, the manufacturer's and importer's details and the instructions are in place, and must not sell a product it has reason to believe does not conform (Article 12(1) and (3)). Where a product it has already sold is dangerous or lacks those elements, it must inform the manufacturer or importer, ensure corrective measures and ensure the authorities are informed through the Safety Business Gateway (Article 12(4)). The Commission's Blue Guide adds that distributors must be able to show the authorities that they acted with due care (section 3.4). An audit is how a retailer builds that evidence.^[1][3]

The processes matter as much as the files. Manufacturers must provide channels for consumer complaints, investigate complaints about dangerous products and keep an internal register of complaints, recalls and corrective measures (Article 9(11) and (12)); importers file complaints in that register or their own and keep the manufacturer and distributors informed (Article 11(10)). On request, every economic operator identifies its suppliers and customers for the product and can present that information for six years (Article 15(3) and (5)).^[1]

Findings can trigger legal duties. If an audit shows that a product already placed is dangerous, the manufacturer must immediately take corrective measures, inform consumers and notify the market surveillance authorities through the Safety Business Gateway (Article 9(8)); the importer has a parallel duty (Article 11(8)). Authorities can in turn require documents and supply chain data from any economic operator (Regulation (EU) 2019/1020, Article 14(4)(a) and (b)). For products under CE acts, the GPSR's Chapter III, Section 1 does not apply (Article 2(1), third subparagraph, point (b)) and the sector acts set the corresponding duties.^[1][2]